Vulnerability · Published Dec 17, 2025 · Assigned by VulnCheck
CVE-2023-53933Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload
High 8.8
In plain English
A high-severity unrestricted file upload in Serendipity from s9y. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 36.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| s9y | Serendipity | 2.4.0 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51372 exploit
- Official Product Homepage product
- VulnCheck Advisory: Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload third-party-advisory